Skip to content

Commit 0453eab

Browse files
author
Per Goncalves da Silva
committed
Make service-account optional
Signed-off-by: Per Goncalves da Silva <[email protected]>
1 parent 28a40f8 commit 0453eab

File tree

17 files changed

+81
-40
lines changed

17 files changed

+81
-40
lines changed

‎api/v1/clusterextension_types.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -66,10 +66,10 @@ type ClusterExtensionSpec struct {
6666
// with the cluster that are required to manage the extension.
6767
// The ServiceAccount must be configured with the necessary permissions to perform these interactions.
6868
// The ServiceAccount must exist in the namespace referenced in the spec.
69-
// serviceAccount is required.
69+
// serviceAccount is optional.
7070
//
71-
// +kubebuilder:validation:Required
72-
ServiceAccount ServiceAccountReference `json:"serviceAccount"`
71+
// +optional
72+
ServiceAccount *ServiceAccountReference `json:"serviceAccount"`
7373

7474
// source is a required field which selects the installation source of content
7575
// for this ClusterExtension. Selection is performed by setting the sourceType.

‎config/base/operator-controller/crd/bases/olm.operatorframework.io_clusterextensions.yaml

+1-2
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ spec:
135135
with the cluster that are required to manage the extension.
136136
The ServiceAccount must be configured with the necessary permissions to perform these interactions.
137137
The ServiceAccount must exist in the namespace referenced in the spec.
138-
serviceAccount is required.
138+
serviceAccount is optional.
139139
properties:
140140
name:
141141
description: |-
@@ -458,7 +458,6 @@ spec:
458458
has(self.catalog) : !has(self.catalog)'
459459
required:
460460
- namespace
461-
- serviceAccount
462461
- source
463462
type: object
464463
status:

‎config/base/operator-controller/rbac/role.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,12 @@ rules:
1010
- serviceaccounts/token
1111
verbs:
1212
- create
13+
- apiGroups:
14+
- '*'
15+
resources:
16+
- '*'
17+
verbs:
18+
- '*'
1319
- apiGroups:
1420
- apiextensions.k8s.io
1521
resources:

‎config/overlays/featuregate/webhook-support/kustomization.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# kustomization file for secure OLMv1
2+
# DO NOT ADD A NAMESPACE HERE
3+
apiVersion: kustomize.config.k8s.io/v1beta1
4+
kind: Kustomization
5+
resources:
6+
- ../../../base/operator-controller
7+
- ../../../base/common
8+
components:
9+
- ../../../components/tls/operator-controller
10+
11+
patches:
12+
- target:
13+
kind: Deployment
14+
name: operator-controller-controller-manager
15+
path: patches/enable-featuregate.yaml

‎config/overlays/featuregate/webhook-support/patches/enable-featuregate.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# enable synthetic-user feature gate
2+
- op: add
3+
path: /spec/template/spec/containers/0/args/-
4+
value: "--feature-gates=WebhookSupport=true"

‎docs/api-reference/operator-controller-api-reference.md

+1-1
Original file line numberDiff line numberDiff line change
@@ -306,7 +306,7 @@ _Appears in:_
306306
| Field | Description | Default | Validation |
307307
| --- | --- | --- | --- |
308308
| `namespace` _string_ | namespace is a reference to a Kubernetes namespace.<br />This is the namespace in which the provided ServiceAccount must exist.<br />It also designates the default namespace where namespace-scoped resources<br />for the extension are applied to the cluster.<br />Some extensions may contain namespace-scoped resources to be applied in other namespaces.<br />This namespace must exist.<br /><br />namespace is required, immutable, and follows the DNS label standard<br />as defined in [RFC 1123]. It must contain only lowercase alphanumeric characters or hyphens (-),<br />start and end with an alphanumeric character, and be no longer than 63 characters<br /><br />[RFC 1123]: https://tools.ietf.org/html/rfc1123 | | MaxLength: 63 <br />Required: \{\} <br /> |
309-
| `serviceAccount` _[ServiceAccountReference](#serviceaccountreference)_ | serviceAccount is a reference to a ServiceAccount used to perform all interactions<br />with the cluster that are required to manage the extension.<br />The ServiceAccount must be configured with the necessary permissions to perform these interactions.<br />The ServiceAccount must exist in the namespace referenced in the spec.<br />serviceAccount is required. | | Required: \{\} <br /> |
309+
| `serviceAccount` _[ServiceAccountReference](#serviceaccountreference)_ | serviceAccount is a reference to a ServiceAccount used to perform all interactions<br />with the cluster that are required to manage the extension.<br />The ServiceAccount must be configured with the necessary permissions to perform these interactions.<br />The ServiceAccount must exist in the namespace referenced in the spec.<br />serviceAccount is optional. | | |
310310
| `source` _[SourceConfig](#sourceconfig)_ | source is a required field which selects the installation source of content<br />for this ClusterExtension. Selection is performed by setting the sourceType.<br /><br />Catalog is currently the only implemented sourceType, and setting the<br />sourcetype to "Catalog" requires the catalog field to also be defined.<br /><br />Below is a minimal example of a source definition (in yaml):<br /><br />source:<br /> sourceType: Catalog<br /> catalog:<br /> packageName: example-package | | Required: \{\} <br /> |
311311
| `install` _[ClusterExtensionInstallConfig](#clusterextensioninstallconfig)_ | install is an optional field used to configure the installation options<br />for the ClusterExtension such as the pre-flight check configuration. | | |
312312

‎hack/demo/resources/optional-sa/cluster-extension.yaml

+12
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
---
2+
apiVersion: olm.operatorframework.io/v1
3+
kind: ClusterExtension
4+
metadata:
5+
name: zookeeper-operator
6+
spec:
7+
namespace: argocd
8+
source:
9+
sourceType: Catalog
10+
catalog:
11+
packageName: zookeeper-operator
12+
version: 0.17.0

‎internal/operator-controller/action/restconfig.go

+3
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,9 @@ import (
1515
func ServiceAccountRestConfigMapper(tokenGetter *authentication.TokenGetter) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
1616
return func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
1717
cExt := o.(*ocv1.ClusterExtension)
18+
if cExt.Spec.ServiceAccount == nil {
19+
return rest.CopyConfig(c), nil
20+
}
1821
saKey := types.NamespacedName{
1922
Name: cExt.Spec.ServiceAccount.Name,
2023
Namespace: cExt.Spec.Namespace,

‎internal/operator-controller/applier/helm.go

+2-1
Original file line numberDiff line numberDiff line change
@@ -125,7 +125,7 @@ func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExte
125125
labels: objectLabels,
126126
}
127127

128-
if h.PreAuthorizer != nil {
128+
if h.PreAuthorizer != nil && ext.Spec.ServiceAccount != nil {
129129
err := h.runPreAuthorizationChecks(ctx, ext, chrt, values, post)
130130
if err != nil {
131131
// Return the pre-authorization error directly
@@ -166,6 +166,7 @@ func (h *Helm) Apply(ctx context.Context, contentFS fs.FS, ext *ocv1.ClusterExte
166166
rel, err = ac.Install(ext.GetName(), ext.Spec.Namespace, chrt, values, func(install *action.Install) error {
167167
install.CreateNamespace = false
168168
install.Labels = storageLabels
169+
install.CreateNamespace = true
169170
return nil
170171
}, helmclient.AppendInstallPostRenderer(post))
171172
if err != nil {

‎internal/operator-controller/applier/helm_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -358,7 +358,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
358358
validCE := &ocv1.ClusterExtension{
359359
Spec: ocv1.ClusterExtensionSpec{
360360
Namespace: "default",
361-
ServiceAccount: ocv1.ServiceAccountReference{
361+
ServiceAccount: &ocv1.ServiceAccountReference{
362362
Name: "default",
363363
},
364364
},
@@ -387,7 +387,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
387387
validCE := &ocv1.ClusterExtension{
388388
Spec: ocv1.ClusterExtensionSpec{
389389
Namespace: "default",
390-
ServiceAccount: ocv1.ServiceAccountReference{
390+
ServiceAccount: &ocv1.ServiceAccountReference{
391391
Name: "default",
392392
},
393393
},
@@ -417,7 +417,7 @@ func TestApply_InstallationWithPreflightPermissionsEnabled(t *testing.T) {
417417
validCE := &ocv1.ClusterExtension{
418418
Spec: ocv1.ClusterExtensionSpec{
419419
Namespace: "default",
420-
ServiceAccount: ocv1.ServiceAccountReference{
420+
ServiceAccount: &ocv1.ServiceAccountReference{
421421
Name: "default",
422422
},
423423
},

‎internal/operator-controller/authorization/rbac_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ subjects:
135135
ObjectMeta: metav1.ObjectMeta{Name: "test-cluster-extension"},
136136
Spec: ocv1.ClusterExtensionSpec{
137137
Namespace: ns,
138-
ServiceAccount: ocv1.ServiceAccountReference{
138+
ServiceAccount: &ocv1.ServiceAccountReference{
139139
Name: saName,
140140
},
141141
},

‎internal/operator-controller/controllers/clusterextension_admission_test.go

+8-8
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
4444
},
4545
},
4646
Namespace: "default",
47-
ServiceAccount: ocv1.ServiceAccountReference{
47+
ServiceAccount: &ocv1.ServiceAccountReference{
4848
Name: "default",
4949
},
5050
}))
@@ -55,7 +55,7 @@ func TestClusterExtensionSourceConfig(t *testing.T) {
5555
SourceType: tc.sourceType,
5656
},
5757
Namespace: "default",
58-
ServiceAccount: ocv1.ServiceAccountReference{
58+
ServiceAccount: &ocv1.ServiceAccountReference{
5959
Name: "default",
6060
},
6161
}))
@@ -114,7 +114,7 @@ func TestClusterExtensionAdmissionPackageName(t *testing.T) {
114114
},
115115
},
116116
Namespace: "default",
117-
ServiceAccount: ocv1.ServiceAccountReference{
117+
ServiceAccount: &ocv1.ServiceAccountReference{
118118
Name: "default",
119119
},
120120
}))
@@ -212,7 +212,7 @@ func TestClusterExtensionAdmissionVersion(t *testing.T) {
212212
},
213213
},
214214
Namespace: "default",
215-
ServiceAccount: ocv1.ServiceAccountReference{
215+
ServiceAccount: &ocv1.ServiceAccountReference{
216216
Name: "default",
217217
},
218218
}))
@@ -267,7 +267,7 @@ func TestClusterExtensionAdmissionChannel(t *testing.T) {
267267
},
268268
},
269269
Namespace: "default",
270-
ServiceAccount: ocv1.ServiceAccountReference{
270+
ServiceAccount: &ocv1.ServiceAccountReference{
271271
Name: "default",
272272
},
273273
}))
@@ -320,7 +320,7 @@ func TestClusterExtensionAdmissionInstallNamespace(t *testing.T) {
320320
},
321321
},
322322
Namespace: tc.namespace,
323-
ServiceAccount: ocv1.ServiceAccountReference{
323+
ServiceAccount: &ocv1.ServiceAccountReference{
324324
Name: "default",
325325
},
326326
}))
@@ -374,7 +374,7 @@ func TestClusterExtensionAdmissionServiceAccount(t *testing.T) {
374374
},
375375
},
376376
Namespace: "default",
377-
ServiceAccount: ocv1.ServiceAccountReference{
377+
ServiceAccount: &ocv1.ServiceAccountReference{
378378
Name: tc.serviceAccount,
379379
},
380380
}))
@@ -433,7 +433,7 @@ func TestClusterExtensionAdmissionInstall(t *testing.T) {
433433
},
434434
},
435435
Namespace: "default",
436-
ServiceAccount: ocv1.ServiceAccountReference{
436+
ServiceAccount: &ocv1.ServiceAccountReference{
437437
Name: "default",
438438
},
439439
Install: tc.installConfig,

‎internal/operator-controller/controllers/clusterextension_controller.go

+1
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ type InstalledBundleGetter interface {
9797
//+kubebuilder:rbac:groups=core,resources=serviceaccounts/token,verbs=create
9898
//+kubebuilder:rbac:groups=apiextensions.k8s.io,resources=customresourcedefinitions,verbs=get
9999
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings;roles;rolebindings,verbs=list;watch
100+
//+kubebuilder:rbac:groups=*,resources=*,verbs=*
100101

101102
//+kubebuilder:rbac:groups=olm.operatorframework.io,resources=clustercatalogs,verbs=list;watch
102103

‎internal/operator-controller/controllers/clusterextension_controller_test.go

+9-9
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func TestClusterExtensionResolutionFails(t *testing.T) {
6969
},
7070
},
7171
Namespace: "default",
72-
ServiceAccount: ocv1.ServiceAccountReference{
72+
ServiceAccount: &ocv1.ServiceAccountReference{
7373
Name: "default",
7474
},
7575
},
@@ -145,7 +145,7 @@ func TestClusterExtensionResolutionSuccessfulUnpackFails(t *testing.T) {
145145
},
146146
},
147147
Namespace: namespace,
148-
ServiceAccount: ocv1.ServiceAccountReference{
148+
ServiceAccount: &ocv1.ServiceAccountReference{
149149
Name: serviceAccount,
150150
},
151151
},
@@ -225,7 +225,7 @@ func TestClusterExtensionResolutionAndUnpackSuccessfulApplierFails(t *testing.T)
225225
},
226226
},
227227
Namespace: namespace,
228-
ServiceAccount: ocv1.ServiceAccountReference{
228+
ServiceAccount: &ocv1.ServiceAccountReference{
229229
Name: serviceAccount,
230230
},
231231
},
@@ -295,7 +295,7 @@ func TestClusterExtensionServiceAccountNotFound(t *testing.T) {
295295
},
296296
},
297297
Namespace: "default",
298-
ServiceAccount: ocv1.ServiceAccountReference{
298+
ServiceAccount: &ocv1.ServiceAccountReference{
299299
Name: "missing-sa",
300300
},
301301
},
@@ -356,7 +356,7 @@ func TestClusterExtensionApplierFailsWithBundleInstalled(t *testing.T) {
356356
},
357357
},
358358
Namespace: namespace,
359-
ServiceAccount: ocv1.ServiceAccountReference{
359+
ServiceAccount: &ocv1.ServiceAccountReference{
360360
Name: serviceAccount,
361361
},
362362
},
@@ -452,7 +452,7 @@ func TestClusterExtensionManagerFailed(t *testing.T) {
452452
},
453453
},
454454
Namespace: namespace,
455-
ServiceAccount: ocv1.ServiceAccountReference{
455+
ServiceAccount: &ocv1.ServiceAccountReference{
456456
Name: serviceAccount,
457457
},
458458
},
@@ -531,7 +531,7 @@ func TestClusterExtensionManagedContentCacheWatchFail(t *testing.T) {
531531
},
532532
},
533533
Namespace: installNamespace,
534-
ServiceAccount: ocv1.ServiceAccountReference{
534+
ServiceAccount: &ocv1.ServiceAccountReference{
535535
Name: serviceAccount,
536536
},
537537
},
@@ -611,7 +611,7 @@ func TestClusterExtensionInstallationSucceeds(t *testing.T) {
611611
},
612612
},
613613
Namespace: namespace,
614-
ServiceAccount: ocv1.ServiceAccountReference{
614+
ServiceAccount: &ocv1.ServiceAccountReference{
615615
Name: serviceAccount,
616616
},
617617
},
@@ -689,7 +689,7 @@ func TestClusterExtensionDeleteFinalizerFails(t *testing.T) {
689689
},
690690
},
691691
Namespace: namespace,
692-
ServiceAccount: ocv1.ServiceAccountReference{
692+
ServiceAccount: &ocv1.ServiceAccountReference{
693693
Name: serviceAccount,
694694
},
695695
},

‎internal/operator-controller/resolve/catalog_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -586,7 +586,7 @@ func buildFooClusterExtension(pkg string, channels []string, version string, upg
586586
},
587587
Spec: ocv1.ClusterExtensionSpec{
588588
Namespace: "default",
589-
ServiceAccount: ocv1.ServiceAccountReference{Name: "default"},
589+
ServiceAccount: &ocv1.ServiceAccountReference{Name: "default"},
590590
Source: ocv1.SourceConfig{
591591
SourceType: "Catalog",
592592
Catalog: &ocv1.CatalogFilter{

0 commit comments

Comments
 (0)